REMARKS 

Claims 1-15, all the claims pending in the application, stand rejected upon informalities 
and on prior art grounds. Claims 1-5 stand rejected under 35 U.S.C. §101. Applicants 
respectfully traverse these rejections based on the following discussion. The following 
paragraphs have been numbered for ease of future reference. 

I. The 35 U.S.C. §112, First Paragraph, Rejection 

[0001] Claims 1-15 stand rejected under 35 U.S.C. §112, first paragraph, as based on a 
disclosure which is not enabling. These rejections are traversed as explained below. 

[0002] The Communications assertions that "the metes and bounds of "critical 
information: is unclear because the criticality of information seems to be subjective; in other 
words, there is no objective, qualitative, or quantitative evaluation used to access how "critical" 
information is. 

[0003] Applicants note that the claims and the examples in the specification and would 
allow one of ordinary skill in the art to make practice and use the claimed invention. For the 
convenience of the Office, Applicants have also attached the printout of an entry from the 
Department of Defense Dictionary of Military and Associated Terms downloaded from The 
information was downloaded from ( http://web.c-trchive.org/web/200 1 041 80 1 1 140/www.dtic 
.mil/doctrine /jel/doddict/data/c/0 1663.html ) on February 28, 2009 reflecting information 
archived with the Internet Archive on April 13, 2001. Thus, it should be clear that the term 
"critical information" was easily discernible to those of even ordinary skill in the art. 
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[0004] The Communication asserts that "[t]he specification does not discuss the possible 
consideration of factors other than the amount and/or duration of information exposure." 
(Communication, p. 9, 11. 1-3). However, Applicants draw attention to Table 2 of the Published 
Application which recites: 

^ l .e i d i The term e i denotes the exposure number of information unit "i", 
and d i denotes its duration. Each information unit may not be 
equally sensitive. (Published Application, p. 2, Table 2, emphasis added). 

[0005] The use of the determined critical or sensitive information is described in the 
Published Application at, for example paras. 22 and 23. The Published Application further 
describes how the workflow manager segments the state of the AS that needs to be forwarded in 
the flow using the targeted AS configuration information, (see for example, Published 
Application, p. 3, para. 40). Thus, notwithstanding Communication assertions to the contrary, 
the Published Application defines a fully enabled implementation of Applicants claimed 
invention. 

[0006] Although the Communication further asserts that "the specification does not 
specify how the additional considerations would combined with said temporarily stored critical 
information in order to calculate an exposure cost." (Communication, p. 9. 11. 8-10); Applicants 
respectfully submit that the Published Application describes the use of Analysis Engines in Fig. 
5 and at for example, paras. 35-44. The use is recited in the Published Application at, for 
example, paras. 43-44. Thus, Applicants respectfully submit that the Application is enabled. In 
view of the foregoing, the Examiner is respectfully requested to reconsider and withdraw this 
rejection. 
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II. The 35 U.S.C. §112, Second Paragraph, Rejection 

[0007] Claims 1-15 stand rejected under 35 U.S.C. § 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. These rejections are traversed as explained below. 

[0008] The term "critical information" is well understood and easily discernible by those 
of ordinary skill in the art by reference to the Department of Defense Dictionary of Military and 
Associated Terms discussed above. 

[0009] Applicants note that the courts have held that "[t]he requirement to 'distinctly' 
claim means that the claim must have a meaning discernible to one of ordinary skill in the art 
when construed according to correct principles. . ..Only when a claim remains insolubly 
ambiguous without a discernible meaning after all reasonable attempts at construction must a 
court declare it indefinite." Metabolite Labs., Inc. v. Lab. Corp. of Am. Holdings, 370 F.3d 1354, 
1366, 71 USPQ2d 1081, 1089 (Fed. Cir. 2004). 

[0010] In Bancorp Services, L.L.C. v. Hartford Life Ins. Co., 359 F.3d 1367, 1372, 69 
USPQ2d 1996, 1999-2000 (Fed. Cir. 2004), the court held that the disputed claim term "surren- 
der value protected investment credits" not indefinite because "the components of the term have 
well recognized meanings, which allow the reader to infer the meaning of the entire phrase with 
reasonable confidence"). See also MPEP 2173.02. 

[0011] Applicants respectfully submit that when such an analysis is properly conducted 
with respect to the claims as a whole rather than in parts, the claims are definite. Attention is 
drawn to Figs. 3-7 and to, for example, paragraphs 35-47 of the Published Application indicating 
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these features. Thus, the recited claim terms meets the objective statutory requirements of 35 
U.S.C. §112, 2 nd . 

[0012] In view of the foregoing, the Examiner is respectfully requested to reconsider and 
withdraw this rejection. 

III. The 35 U.S.C. §101 Rejection 

[0013] Claims 1-5 stand rejected under 35 U.S.C. §101 because the claimed invention is 
directed to non-statutory subject matter. These rejections are traversed as explained below. 

[0014] Claims 1 recites "[a] machine-implemented method for selecting a workflow..." 
Thus, claim 1 and dependent claims 2-4 are directed to statutory class. Applicants therefore 
respectfully request withdrawal of this rejection. 

VI. The Prior Art Rejections 

[0015] Claims 1-15 stand rejected under 35 U.S.C. §103(a) as being unpatentable over 
Chan, et al. (U.S. Patent No. 6,889,375), hereinafter referred to as Chan, in view of Hung Chak 
Kuen Patrick's "Secure Workflow Model," hereinafter referred to as Patrick and further in view 
of Michael zur Muehlen's: Workflow-Based Process Controlling - Or: What Your Can Measure 
You Can Control," hereinafter referred to as Muehlen. Applicants respectfully traverse these 
rejections based on the following discussion. 

[0016] Applicants submit that Chan, alone or in combination with Patrick, and/or 
Muehlen fails to disclose, teach or even suggest at least the features directed to: 1) constructing a 
set of possible workflows meeting a workflow specification having a predetermined input and a 
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required output, using components having defined inputs and outputs; 2) calculating an exposure 
cost measure for each of the possible workflows in the set of possible workflows, said exposure 
cost measure being based upon, in part, details of critical information that is temporarily stored 
between processing steps within each of said possible workflows ; 3) selecting a target workflow 
from the constructed set of possible workflows for which the exposure cost measure is calculated 
to be a minimum, as recited in independent claim 1 and similarly recited in independent claims 6 
and 7. 

[0017] Chan merely describes a system for application development. The system 
includes programming entities, which include a workflow and a container. A contract specifies 
an interaction between at least two programming entities. 

[0018] Moreover, the Communication admits that Chan fails to disclose at least the 
features directed to "2) calculating an exposure cost measure for each of the possible workflows 
in the set of possible workflows, said exposure cost measure being based upon, in part, details of 
critical information that is temporarily stored between processing steps within each of said 
possible workflows. Applicants agree. The Communication attempts to remedy these admitted 
deficiencies by combining Chan with Patrick. 

[0019] Patrick describes Workflow Management Systems used to support many of the 
day to day workflows in large organizations. Patrick asserts as one of the major problems with 
workflow management systems is that they often use heterogeneous and distributed hardware 
and software systems to execute a given workflow giving rise to decentralized security policies 
and mechanisms that need to be managed. Since security is an essential and integral part of 
workflows, the workflow management system has to manage and execute the workflows in a 
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secure way. The prolific use of workflow management systems for critical and strategic 
applications gives rise to a major concern regarding the threats against integrity, authorization, 
and availability. Thus, Patrick proposes an authorization model with a set of invariants for 
workflows from the aspects of agents, events and data, and assertedly proves that if they hold, 
the workflow execution is secure. Patrick also describes the development of an authorization 
model based on a multi-layered state machine that separates the various aspects of control in a 
workflow and portrays it as a multi-layered architecture for analyzing the flow of authorizations. 
[0020] The Communication states that Patrick teaches the steps of: 
"(b) calculating a exposure measure for each of the possible workflows in the set of 
possible workflows (Security Risk Factor - the maximum number of tasks done by any one 
agent. Essentially the SRF measure the level of risk associated with a set of agents 
executing a group of inter-dependent tasks; Security Risk factor...is based on evenly 
distributing the tasks over a set of agents with the condition that all the agents are capable 
of executing all the tasks and all of them can access the documents with the different 
privileges needed by each task... We introduce the concept of Security Risk Value and 
incorporate it into SRF. SRV is a value from 0 to 1.0 that indicates the level of risk. The 
higher the value, the higher the risk) [pages 73, 79, 96]" (see Communication, p. 14, 11. 2-11, 
emphasis in the original). 

[0021] Applicants note that independent claim 1 actually recites: 

2) calculating an exposure cost measure for each of the possible workflows in the set 
of possible workflows, said exposure cost measure being based upon, in part, details of critical 
information that is temporarily stored between processing steps within each of said possible 
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workflows " 

[0022] Moreover, the claims recite inter-relationships between terms that the 
Communication appears to ignore. For example, the Communication asserts that Patrick 
discloses "selecting the constructed set of possible workflows for which the exposure measure is 
calculated to be a minimum" (Communication, p. 14, 11. 12-16). However, the Communication 
fails to explain how the Chan-Patrick combination could select anything "for which the exposure 
measure is calculated to be a minimum" when the Communication admits at p. 15, 11. 10-12 that 
"[t]he combined teachings of Chan et al. and Patrick do not explicitly teach an exposure cost 
measure being based upon, in part details of critical information that is temporarily stored 
between processing steps within each of said possible workflows." Applicants submit that the 
Office bears the burden of establishing a prima facie case basis for any rejection offered or else 
must allow the case. The Communication fails to address at least the above-noted inter- 
relationship among the recited terms and thus fails to establish a prima facie case. 

[0023] Moreover, as noted in the Communication, Patrick's SRF merely measures the 
level of risk associated with a set of agents executing a group of inter-dependent tasks. This is 
simply a description of a conventional "information wall." Patrick therefore defines the Security 
Risk Factor (SRF) to be the maximum number of tasks done by any one agent." (Patrick, p. 72). 

[0024] Patrick notes that agents in an exemplary group have higher privileges and 
perform more tasks and hence are more knowledgeable about the operation of the organization. 
Patrick asserts theses agents become crucial to the competiveness of the organization and are 
seen as a higher risk if they move to another organization or are corrupted, (see Patrick, p. 74, 11. 
6-9). Thus, Patrick proposes to manage and control the privileges of the workflow. (Patrick, p. 
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74, 11. 14-19). 

[0025] Patrick therefore suggests assigning a task across as many agents as possible to 
reduce the SRF or dependence on any one agent. This merely describes the selection of agents in 
line with the conventional information wall discussed above. Moreover, the Patrick paper admits 
that computation of an optimal solution based on SRF has exponential complexity. That is, 
Patrick admits the use of SRF in analyses suffers from problems of exponential explosion. 
Given the fact that Patrick is not a patent reference and is therefore not assumed to be enabling, 
Patrick's admissions regarding its problems with exponential explosion highlight the fact that the 
Communication assumes a fact not established - that Patrick is enabled. Thus, the 
Communication fails to establish a prima facie case due to reliance on facts not in evidence. 

[0026] Moreover, Patrick goes on to define Security Risk Value (SRV) as a "[v]alue 
from 0 to 1.0 that indicates the level of risk." (see for example, Patrick, p. 96, 11. 1 1). 
Interestingly, Patrick also admits at p. 96, 11. 19-20, that "[t]he methodology of calculating SRV 
for a task is out of the scope of this thesis." Thus, Patrick also admits that it is not an enabling 
disclosure for calculating the Security Risk Values. 

[0027] The Communication appears to ignore these admitted deficiencies of Patrick and 
asserts that the SRV number maps to the exposure cost measure. Applicants acknowledge that 
although the Office is not subject to estoppel, it is surely constrained to interpret its own 
reference consistently with respect to the author's own statements. 

[0028] As asserted in the prior Response, the claims and the Specification describe 
minimizing the exposure cost measure so as to reduce the time information is exposed (Published 
Application, Fig. 3 and 4). The Communication has offered no enabled alternative that is 
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consistent with the claims and the Published Application. 

[0029] The Communication further admits that neither Chan nor Patrick disclose: 2) 
calculating an exposure cost measure for each of the possible workflows in the set of possible 
workflows, said exposure cost measure being based upon, in part, details of critical information 
that is temporarily stored between processing steps within each of said possible workflows . 
Applicants agree. However, the Communication attempts to combine Meuhlen with the asserted 
Chan-Patrick combination to remedy these deficiencies. 

[0030] Muehlen merely describes the analysis of automated business processes through 
the analysis of protocol data as one factor for the use of workflow management systems in 
organizations. Applicants can discern no indication within Muehlen of a specification for a 
system or method but merely another research paper that concludes somewhat characteristically 
that "[t]he active feedback of evaluation data on the modeling of workflow processes is a 
promising candidate for further research." (Muehlen, p. 76, 11. 9-10). 

[0031] Applicants respectfully submit that as non-patent literature, Muehlen has not been 
examined and is therefore not entitled to the assumption of enablement. No evidence presented 
by the Communication establishes enablement while statements within the Muehlen reference 
appear to indicate it is not enabled. 

[0032] The Communication asserts that since Muehlen provides measures to evaluate 
workflow-based processes, (Communication, p. 16, 11. 3) it would have been obvious to combine 
Muehlen with Chan-Patrick to "calculate the exposure cost of a workflow using the information 
that is temporarily stored between processing steps, because doing so would enable the selection 
of the cheapest/fastest/most effective resource that satisfies certain qualification criteria, as 
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taught by Muehlen [page 72]" (Communication , p. 16, 11. 3-14). 

[0033] Applicants respectfully submit that any interpretation offered by the 
Communication must at least be consistent with the features recited in the claims. Muehlen 
describes the "cheapest/fastest/most effective resource that satisfies certain qualification 
criteria." In contrast, Applicants claim 1 recites 3) selecting a target workflow from the 
constructed set of possible workflows for which the exposure cost measure is calculated to be a 
minimum. 

[0034] Moreover, the Communication appears to ignore the guidance afforded in the 
Published Application as to the calculation of an exposure cost measure, (see for example, 
Communication, p. 3, 11. 8-15). Although the Specification is not read into the claim, it is 
improper to offer an interpretation of the claims that is inconsistent with Applicants' claims and 
the teachings of the Specification. Thus, Muehlen' s cheapest/fastest/most effective analysis is 
inconsistent with Applicants Published Application which suggest that exposure measure should 
be reduced with possible increases in resource usage and reduced speed . In fact, Muehlen' s 
academic paper on efficiencies teaches away from reducing the exposure cost measure since in at 
least some cases, this may reduce resource efficiency. 

[0035] The claimed invention, as provided in amended independent claims 1, 6 and 7 
contain features, which are patentably distinguishable from the prior art references of record. 
Specifically, claims 

[0036] Moreover, the Applicants note that all claims are properly supported in the 
specification and accompanying drawings, and no new matter is being added. In view of the 
foregoing, the Examiner is respectfully requested to reconsider and withdraw the rejections. 
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V. Formal Matters and Conclusion 

[0037] With respect to the rejections to the claims, the claims have been amended, above, 
to overcome these rejections. In view of the foregoing, the Examiner is respectfully requested to 
reconsider and withdraw the rejections to the claims. 

[0038] In view of the foregoing, Applicants submit that claims 1-15, all the claims 
presently pending in the application, are patentably distinct from the prior art of record and are in 
condition for allowance. The Examiner is respectfully requested to pass the above application to 
issue at the earliest possible time. 

[0039] Should the Examiner find the application to be other than in condition for 
allowance, the Examiner is requested to contact the undersigned at the local telephone number 
listed below to discuss any other changes deemed necessary. Please charge any deficiencies and 
credit any overpayments to Attorney's Deposit Account Number 09-0441. 



Respectfully submitted, 



Dated: March 4, 2009 /Christian Austin-Hollands/ 

Christian Austin-Hollands 
Registration No. 46,527 

Gibb LP. Law Firm, LLC 
2568-A Riva Road, Suite 304 
Annapolis, MD 21401 
Voice: (410) 573-1545 
Fax: (301) 261-8825 
Customer Number: 29154 



10/729,814 



17 



